Privacy policy

Last updated 14 November 2026

DRAFT pending legal review

This page is a first draft written to match what the software does. It has not been reviewed by a lawyer and is not yet in force. Highlighted items are still to be confirmed.

Points for the reviewer

This draft was rewritten to describe what the app and servers do today, checked against the code (mobile/lib, backend/app, supabase/migrations). Removed because nothing collects them: location stored with a scan, notification tokens, analytics events from the app, error reports from the app, the shop the user said they were in, and the country the app is used in. docs/store-privacy-forms.md has the evidence for each.
Location: the policy now says Gwin does not collect it. The app has no location permission or plugin and sends no coordinates. The server still has the means: the upload route accepts optional latitude, longitude and accuracy fields and the scans table has columns for them. They are empty for every scan the app makes. Consider removing the fields so no other client can make the statement untrue.
Notifications: the server has routes and tables for notification tokens and choices, but the app never asks for the permission, registers nothing, and nothing sends. The policy therefore says nothing about notifications. Put a section back, name the sending provider and add the consent row to the legal-basis table before the app starts to ask.
Analytics and error reports are described per surface. The app sends neither. The server sends PostHog one event about a user (scan_limit_reached: account id, the month's scan counts, bonus scans), its own exception reports, and in production its logs, only when POSTHOG_API_KEY is set; it sends Sentry its own error reports only when SENTRY_DSN is set (SENTRY_SEND_DEFAULT_PII is off by default). The paragraphs and table rows about PostHog and Sentry are shown only when this server has them configured, so read this page on the production configuration. On this server: app analytics not configured; error reporting not configured; website analytics not configured.
Server logs can contain the account identifier and the IP address. Uploads are also counted per account and per IP address, by the hour and by the day, to limit abuse; those counts expire by themselves.
The shop: the app does not ask which shop the user is in and sends none with a scan. The server files every scan under its default wine list (SCAN_DEFAULT_RETAILER). The profile has a country field the app never sets; the policy no longer mentions a country.
Display name: the server makes one from the part of the email address before the @ only when a profile is first created with an email. Every user starts as a guest, so in practice it is usually empty. The policy says 'may'.
Subscriptions are written in the present tense because the app sells Gwin Premium as soon as the RevenueCat keys are set. No RevenueCat project has been connected and no purchase has been made end to end: confirm the section against the live set-up, and against what RevenueCat's own software collects from the phone, before this policy is in force. The app gives RevenueCat the account identifier for every user, subscriber or not.
A log of the subscription events RevenueCat sends (type, time, product, what was done, the account it applied to) has no retention period; it is detached from the account when the account is deleted. Deleting an account does not ask RevenueCat to delete its customer record, which is filed under the account identifier: decide whether to add that request or to keep saying, as the policy now does, that RevenueCat and the stores keep their own records.
Two monthly scan counters are not keyed on the account and are not removed when an account is deleted: one on the app install id, one on a SHA-256 digest of a value the app derives from the user's store / RevenueCat customer record (a product id and first purchase date, a transaction id, or the date the store account first got the app). A retention period needs setting for both. The digest is unsalted and the value behind it is not very varied, so treat it as pseudonymous personal data, not as anonymous.
The install id is kept in the iPhone keychain (this device only) and so survives deleting and reinstalling the app; the policy says so. On Android it is in the app's own storage with a copy in shared preferences, and the app does not switch off Android's automatic backup, so it may also come back after a reinstall. That has not been checked on a device; the policy's Android sentence is worded to allow for it.
While a free scan is being processed its job record holds the app install id and the store digest, so that scans in progress count towards the allowance. Both are removed from the record when the job ends.
Deleting a single scan removes its photograph and thumbnail from storage straight away. A hidden record stays until the account is deleted: what was read from the labels (words, prices, where each bottle was), the wine list it was checked against and the time. It feeds the list of unrecognised bottles and the monthly usage count. Decide whether keeping that record is acceptable.
A scan deleted before this change kept its photograph. Run backend/scripts/purge_deleted_scan_photos.py once on any environment that has such scans, or the sentence about deletion is not true for them.
Kept after an account is deleted, with no link to the person: a price read from a shelf label (stored as an observation of that wine's price, its link to the scan cleared) and any name a label was read as that a reviewer recorded as another name for a wine. Confirm these are outside the definition of personal data.
Cut-outs of bottles that were not recognised are looked at by a person (the unmatched queue in /ops). The policy now says so in the photos section. A cut-out could show part of a bystander.
Shelf photos are sent to Google's Gemini API to be read: always for the labels and price tickets (cut-outs of each bottle), and the whole photo when Gemini is the bottle detector, when it stands in for a GPU service that is down or slow, and for the small copy used to choose a detector. Confirm the terms of that service (retention, training) and the transfer mechanism. Google's API has had a free tier whose terms allow prompts to be used to improve its products and a paid tier whose terms do not: which one production uses decides whether 'they act on our instructions' is true.
Shelf photos are also sent to GPU services to find the bottles, depending on configuration. RECOGNITION_DETECTOR = spot_yolo, runpod or scene_routed sends the photo (whole, and in strips) to our YOLO-World detection service, which runs on machines rented from RunPod: an always-on pod (SPOT_YOLO_URL) or RunPod Serverless (RUNPOD_YOLO_ENDPOINT_ID). RECOGNITION_DETECTOR = sam3 or scene_routed also sends a reduced copy (1280 pixels on the long edge) to SAM 3: with VISION_SAM_PROVIDER = fal (the default) the copy is uploaded to fal.ai's file storage and then processed by fal.ai; with VISION_SAM_PROVIDER = runpod it goes to our own SAM 3 service on RunPod Serverless. With RECOGNITION_DETECTOR = gemini none of these is used. What RunPod and fal.ai keep, and for how long, is not known: confirm the retention and training terms of both (fal.ai's uploaded files in particular: the software does not delete them), where they process data, and the transfer mechanism. Our own detection service is not part of this repository; confirm it keeps no photos or logs of them.
Photo processing on this server: detector scene_routed; Gemini: configured; YOLO-World: not configured; SAM 3 on fal.ai: not configured.
Whether sending photographs to Google, RunPod and fal.ai is 'sharing' depends on each store's definition and on those companies' terms. Google Play's Data safety form does not count a transfer to a service provider that only processes data for the developer; Apple's App Privacy section asks what is collected and for which purposes, including by third-party partners. If any of the three may keep or reuse photographs for its own purposes, the policy's 'they act on our instructions', the Data safety answer for Photos and Apple's purposes all need changing together.
Retention at the other processors (Supabase, PostHog, Sentry, RevenueCat, Cloudflare) is set by their terms and settings, not by this software. Record each one before filling the retention placeholders.
Leftovers are cleared by a scheduled sweep (POST /api/v1/admin/scans/sweep, or backend/scripts/sweep_scan_photos.py): photographs of scans that stopped part-way, and of scans deleted before photographs were removed with them. It has to be scheduled; until it is, the sentence about a failed scan's photo being deleted is not guaranteed when a server stops mid-scan.
Guest accounts that are abandoned: a guest who deletes the app without deleting the account first leaves the account, its scans and its photographs on the server. Nobody can sign in to it again, nothing removes it, and it can be found only by the account reference shown in the app. Decide on a retention period for accounts that are not used.
A deletion request by email (the route on the support page that Google Play requires) is carried out by hand: there is no admin tool for it. Deleting the user in Supabase Auth removes the rows; the photo directory for that account has to be removed as well. Decide how the person asking is checked: an email from the account's address, or for a guest the account reference, which is weak proof.
If the sign-in service sends confirmation or password emails, the company that delivers them is not named in the table below. Add it.
Hosting locations and the hosting provider are not recorded in the software and are placeholders below.
No retention periods are enforced in code yet apart from the ones stated here.
Free accounts can open only recent scans (the history window). Older scans are kept, not deleted, and are shown again to a subscriber. Confirm the policy is clear enough that they are still held.
Two statements here are commitments rather than descriptions of the software: that personal data is not sold, and that it is not shared with retailers or producers. Confirm both.

Who we are

Gwin is operated by [Company name to be confirmed] (company number: [Registration number to be confirmed]). Registered address: [Registered address to be confirmed].

We are the controller of the personal data described here. ICO registration: [ICO registration reference to be confirmed]. Contact for data protection questions: [Contact email to be confirmed].

In short

Gwin is for people aged 18 or over.
You can use the app as a guest. We do not ask for your name or date of birth.
Gwin does not collect your location.
We keep the shelf photos you take so you can look at your scans again, until you delete the scan or your account. To read them, we send them to companies that work for us.
Your saved wines, ratings and notes are private to you.
The app shows no adverts, has no analytics or crash-reporting software in it, and does not track you across other apps or websites.
We do not sell your data.
You can delete your account, and what goes with it, from inside the app, or ask us to do it.

What the app collects

Your account

When you first open the app it creates a guest account: a random identifier with no name or email. If you choose to add an email address and password, we hold the email address, and our servers may store a display name made from the part of it before the @. Your password is sent only to our sign-in service, which is provided by Supabase; the rest of our servers never receive it. Adding an email keeps the same identifier, so your scans and saved wines stay with you.

We record the date and time you confirmed you are 18 or over. We do not ask for your date of birth.

Shelf photos and scans

When you scan a shelf we receive and keep:

the photograph, whether you take it in the app or choose it from your photo library. Our servers re-save it without the information your camera embeds in it (such as the camera model or where it was taken);
the date and time, and which of our wine lists the photograph was checked against. The app does not ask which shop you are in;
what was recognised: the wines we matched, the words and prices read from labels and shelf tickets, and where each bottle was in the picture.

To recognise the bottles, your photograph, or a smaller copy or cut-outs of it, is sent to services that work on our behalf: Google, which reads the labels and price tickets, and GPU services that find the bottles in the picture, which run on RunPod and, for some photographs, at fal.ai. They receive the picture only: not your name, email address or account identifier.

When Gwin does not recognise a bottle, a member of our team may look at the cut-out of that bottle so that we can add the wine to our list. A price read from a shelf label may be kept as a note of what that wine costs.

Please try not to include other people in your photographs. A photo that cannot be read, or a scan that fails, is deleted from our servers straight away.

Location

Gwin does not collect your location. The app does not ask for permission to use it and does not send it to us. If your camera has written a location into a photograph, it is removed when the photograph is re-saved and is not kept. Our servers see the IP address your phone connects from, as any internet service does; we do not use it to work out where you are.

Saved wines, ratings and notes

If you save a wine, rate it or write a note about it, we store that against your account, along with the answers you give to the app's questions about your taste. From your ratings and answers we work out a simple taste profile so the app can point out wines you are likely to enjoy. These are private to you: they are not shown to other people and are not combined across users.

Usage and your device

We count your scans each month to apply the free allowance. So that the allowance stays fair, and cannot be started again by making a new guest account or installing the app again, we also count free scans in two other ways.

An install identifier. The first time the app runs it makes up a random identifier and keeps it on your phone. The app sends it to us with every request, and we use it to count free scans for that phone. It is not an advertising identifier and no other app can read it. On an iPhone it is stored in the keychain. iOS does not clear the keychain when an app is deleted, so if you delete Gwin and install it again on the same iPhone, the app finds the same identifier and the count for the month carries on. It stays on that iPhone and is not copied to your other devices. On an Android phone it is kept in the app's own storage, which is removed with the app unless your phone restores the app's data from a backup.

A fingerprint of your store account. The app works out a short value from the record the App Store or Google Play holds for your store account, as it is reported to the app by RevenueCat (see Subscriptions): the plan and date of a first purchase if there is one, otherwise the date your store account first got Gwin. The app sends that value when you scan a shelf and when it checks your subscription. Our servers turn it straight away into a fingerprint, a fixed string of letters and numbers worked out from the value (a SHA-256 digest), and keep only the fingerprint with a count of free scans for the month. The value itself is not stored and is not written to our logs. The same store account always gives the same fingerprint, which is how the count carries on after the app is installed again.

Both counts are kept separately from your account. Each holds the identifier or the fingerprint, the month and a number, and neither holds your name or email address. We also note the install identifier most recently used with your account, and keep it and the fingerprint with a scan while that scan is being processed.

To stop misuse we count how many photographs are sent from each account and from each IP address in an hour and in a day. The app also keeps what it needs on your phone, such as your sign-in, your answer to the 18 or over question and the install identifier.

Subscriptions

Gwin Premium is bought through the App Store or Google Play. Apple or Google takes the payment, and we never see your card details. The app uses a service called RevenueCat to handle the purchase with the store. The app gives RevenueCat your Gwin account identifier, whether or not you subscribe, so that a purchase can be matched to your account, and RevenueCat receives the record of your Gwin Premium purchases from the store.

RevenueCat tells our servers when a subscription starts, renews, is cancelled or ends. Against your account we hold whether you have Premium, which plan it is, whether it is a free trial, whether it is set to renew, when it ends, and the date of a cancellation or a failed payment. We also keep a log of the messages RevenueCat sends us: the kind of event, when it happened, the plan, and what we did about it.

Analytics and error reports

The app has no analytics software and no crash-reporting software in it. It does not send us statistics about how you use it or reports of errors on your phone.

Our servers keep logs of requests, which can include your IP address and your account identifier. Words you type into the search box in Browse are sent to our servers to find wines. They are not saved to your account, but they can appear in those logs.

What this website collects

No cookies unless you say yes. The site sets no cookies by default. If you dismiss the age notice or make a choice about analytics, that choice is remembered in your browser's local storage so we do not ask again.
Analytics only with your agreement. Website analytics is not switched on. If we turn it on, it will use PostHog (hosted in the European Union) and will only load after you agree in a banner.
Server logs. Like any website, our servers and our network provider (Cloudflare) record requests, including IP addresses, to keep the site running and secure.

Why we use it, and our legal basis

Purpose	Legal basis
Running the app: recognising bottles, keeping your scans, saves and ratings, and applying your subscription	Performing our contract with you
Applying the free allowance and stopping abuse of it	Our legitimate interests
Improving the wine list, for example by looking at bottles we did not recognise	Our legitimate interests
Finding and fixing faults on our servers	Our legitimate interests
Website analytics	Your consent
Keeping records the law requires	Legal obligation

Who else handles your data

We use these companies to run Gwin. They act on our instructions.

Company	What for
Supabase	Database and sign-in, including your email address and password if you add them
Google (Gemini API)	Reading the labels and price tickets in shelf photographs; finding the bottles when our GPU service is not available
RunPod	GPU servers that run our bottle detection on shelf photographs
fal.ai	Finding the bottles in some shelf photographs
RevenueCat	Handling Gwin Premium purchases with the App Store and Google Play, and telling us whether a subscription is active
Cloudflare	Network and security for the website and API
[Hosting provider and location to be confirmed]	Servers and photo storage

Apple and Google take payment for Gwin Premium and hold their own records of it under their own privacy policies.

Some of these companies process data outside the United Kingdom. Where they do, we rely on [Transfer safeguards to be confirmed].

We do not sell personal data, and we do not share it with retailers or wine producers.

How long we keep it

Your account, scans, photos, saved wines, ratings, notes and taste answers are kept until you delete your account. Deleting your account removes them. How to delete your account.
A single scan you delete is removed from your history, and its photograph is deleted from our servers, straight away. We keep a record without the photograph (what was read from the labels, the wine list it was checked against and the time) to count your monthly allowance and to help us add wines we did not recognise, until your account is deleted.
Older scans on a free account stop being shown after a number of days but are not deleted. They are kept until you delete them or your account.
The two counts of free scans, by install identifier and by store account fingerprint, are kept for [Retention period to be confirmed]. They are not linked to your name or email and are not removed when you delete your account.
The log of subscription events is kept for [Retention period to be confirmed]. It is detached from you when you delete your account. Apple, Google and RevenueCat keep their own records of your purchases, which deleting your Gwin account does not remove.
Facts about wines. A price read from a shelf label, or the name a label was read as, may be kept as a fact about that wine. Once your account is deleted it has no link to you.
Error reports and logs are kept for [Retention period to be confirmed].

Your rights

Under UK data protection law you can ask us to:

give you a copy of your data;
correct it;
delete it;
limit how we use it, or object to our using it;
give it to you in a form you can take elsewhere.

Where we rely on your consent you can withdraw it at any time. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Age

Gwin is about alcohol and is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think someone under 18 is using Gwin, please tell us.

Changes to this policy

If we change this policy we will update the date at the top. If the change is significant we will tell you in the app.